#!/usr/bin/python
from splinter import Browser
from urlparse import urlparse,urlunparse
"""
    @attention: url_1,url_2 just defers in the last param
"""
class HPPTest(object):
    
    def __init__(self,browser,url_1,url_2):
        self.browser=browser
        self.former=url_1
        self.latter=url_2
        
    def dotest(self):
        browser.visit(url_1)
        content1=browser.html
        browser.visit(url_2)
        content2=browser.html
        fo=urlparse(self.former)
        la=urlparse(self.latter)
        fo_params=fo.query.split("&")
        la_params=la.query
        params=la_params+"&"+fo_params[-1]
        url_hpp=urlunparse((fo.scheme,fo.netloc,fo.path,fo.params,params,''))
        browser.visit(url_hpp)
        content3=browser.html
        if content1!=content3 and content2!=content3:
            return True
        else:
            return False
          
    def start(self):
        print "[--HTTP Parameter Pollution Test--]"
        if self.dotest():
            print "HPP exists"
        else:
            print "HPP doesn't exist"
          
browser=Browser("phantomjs")
url_1="http://scan.com?xss=good"
url_2="http://scan.com?xss=bad"
hpp=HPPTest(browser,url_1,url_2)
hpp.start()